Communication Network Solutions for Smart Grids · PDF fileWIFI Mesh Network management ... Communication network solutions for Smart Grids. ... 8.2 Communication Network Solutions

442 Siemens Energy Sector Power Engineering Guide Edition 7.0

443Siemens Energy Sector • Power Engineering Guide • Edition 7.0

8

Communication Network Solutions for Smart Grids

8.1 Introduction 444

8.2 Communication Network Solutions for Transmission Grids (Communication Backbone) 446

8.2.1 Synchronous Digital Hierarchy (SDH)/Ethernet Solutions 446

8.2.2 Access Multiplexer 447

8.2.3 PowerLink – Power Line Carrier for High-Voltage Lines 447

8.2.4 SWT 3000 – Teleprotection for High-Voltage Lines 450

8.2.5 Coupling Unit AKE 100 452

8.2.6 Voice Communication with PowerLink 452

8.2.7 Live Line Installation of OPGW (Optical Ground Wire) 454

8.3 Control Center Communication 455

8.4 Substation Communication 456

8.4.1 Overview of IEC 61850 456

8.4.2 Principle Communication Structures for Protection and Substation Automation Systems 456

8.4.3 Multiple Communication Options with SIPROTEC 5 460

8.4.4 Network Redundancy Protocols 464

8.4.5 Communication Between Substation Using Protection Data Interfaces 467

8.4.6 Requirements for Remote Data Transmission 469

8.5 Communication Network Solutions for Distribution Grids (Backhaul/Access Communication) 470

8.5.1 Introduction 470

8.5.2 Communication Infrastructures for Backhaul and Access Networks 471

8.6 IT Security 474

8.6.1 Integral Approach 474

8.6.2 Secure throughout from Interface to Interface 475

8.6.3 Continuous Hardening of Applications 475

8.6.4 In-House CERT as Know-how Partner 475

8.6.5 Sensible Use of Standards 475

8.6.6 IT Security Grows in the Development Process 475

8.6.7 Integrating IT Security in Everyday Operations 476

8.7 Services 477


8

8 Communication Network Solutions for Smart Grids

8.1 IntroductionA secure, reliable and economic power supply is closely linked to a fast, efficient and dependable communication infrastructure. Planning and implementation of communication networks require the same attention as the installation of the power supply systems themselves (fi g. 8.1-1).

Telecommunication for utilities has a long history in the trans-mission level of the power supply system and Siemens was one of the first suppliers of communication systems for power utilities. Since the early 1930s Siemens has delivered Power Line Carrier equipment for high-voltage systems. In today’s transmis-sion systems, almost all substations are monitored and con-trolled online by Energy Management Systems (EMS). The main transmission lines are usually equipped with fiber-optic cables, mostly integrated in the earth (ground) wires (OPGW: Optical Ground Wire) and the substations are accessible via broadband communication systems. The two proven and optimal communi-

Generation Grid

Applications

Smart Metering

Transmission Applications

Industrial & Infrastr. Grid Applications

Rail Electrification

Distribution Applications

Microgrid / DG / VPP

Applications

Demand Response Vertical SG

solutions

Service

Automation Grid automation platform

Operational IT

Grid control platform

Distribution Mgt. system

Grid application platform

Meter Data Management

Microgrid & Dec. Gen. Controller

Demand Resp. Mgmt. System

Energy Mgt. System

Rail SCADA System

Ind. Distribution Mgt. System

Grid planning & simulation

Field Equipment

Electr./Gas/Water/Heat

Grid-specific Enterprise IT

Horizontal IT

Solutions incl. Primary equipment

Information & Communicat. Grid specific communication platform

Value-added services Grid consulting & design Grid deployment & automation Smart Grid operation & optimization

Fig. 8.1-1: Siemens offers complete communication network solutions to build a Smart Grid for power utilities

cation technologies for application-specifi c needs are Synchro-nous Digital Hierarchy (SDH) and Ethernet. Fiber-optic cables are used whenever it is cost-effi cient. In the remote ends of the power transmission system, however, where the installation of fiber-optic cables or wireless solutions is not economical, substa-tions are connected via digital high-voltage power line carrier systems.

The situation in the distribution grid is quite different. Whereas subtransmission and primary substations are equipped with digital communication as well, the communication infrastruc-ture at lower distribution levels is very weak. In most countries, less than 10 % of transformer substations and ring-main units (RMU) are monitored and controlled from remote.

The rapid increase in distributed energy resources today is impairing the power quality of the distribution network. That is

445Siemens Energy Sector Power Engineering Guide Edition 7.0

Communication Network Solutions for Smart Grids8.1 Introduction

8

For further reading please visit:

www.energy.siemens.com/hq/en/automation/power-transmission-distribution/network-communication

why system operators need to be able to respond quickly in critical situations. A prerequisite for this is the integration of the key ring-main units as well as the volatile decentralized wind and solar generation into the energy management system, and thus into the communication network of the power utilities. Because the local environment differs widely, it is crucial that the right mix of the various communication technologies is deployed. This mix will need to be exactly tailored to the utilities’ needs and the availability of the necessary infrastructure and resources (e.g., availability of fiber-optic cables, frequency spectrum for wireless technologies, or quality and length of the power cables for broadband power line carrier).

In the consumer access area, the communication needs are rising rapidly as well. The following Smart Grid applications request a bidirectional communication infrastructure down to consumer premises.

Exchange of conventional meters with smart meters, which provide bidirectional communications connections between the consumer and energy applications (e.g., meter data management, marketplace, etc.) Management of consumers’ energy consumption, using price signals as a response to the steadily changing energy supply of large distributed producers

If a large number of small energy resources are involved, the power quality of the low-voltage system must be monitored, because the flow of current can change directions when feed conditions are favorable

The selection of a communication solution depends on the customer’s requirements. If only meter data and price signals are to be transmitted, narrowband systems such as narrowband power line carriers or GPRS modems are sufficient. For smart homes in which power generation and controllable loads (e.g., appliances) or e-car charging stations are to be managed, broad-band communication systems such as fiber-optic cables, broad-band power line carriers or wireless solutions are necessary.

For these complex communication requirements, Siemens offers tailored ruggedized communication network solutions for fiber optic, power line or wireless infrastructures, based on the stan-dards of the Energy Industry. Naturally, this also includes a full range of services, from communication analysis to the operation of the entire solution (fig. 8.1-2).

Meter Meter Meter Meter Meter

Generation HV substation HV substation

HV substationHV substationWind offshore

Homes(smart meter with NPLC)

Public chargingfor e-cars Building

Wind onshore

Cold store

380 kV–500 kV

110 kV–230 kV

6 kV–22 kV

30 kV–132 kV

400 V

MV substation

Homes (smart meterwith other connection)

MV substation

Distributedenergy resources

Smart homes withenergy gateway

Low

vo

ltag

eM

ediu

m v

olt

age

Hig

h v

olt

age

RMU with meter data

concentrator RMU RMURMU400 V400 V400 V

End

-to

-en

d s

ecu

rity

Net

wo

rk m

anag

emen

t sy

stem

Applications

Control Center(EMS/DMS)

Virtual PowerPlant

Micro GridController

DistributionAutomation

ConditionMonitoring

DemandResponseManagementSystem

MarketplaceAssetManagement

Meter DataManagement

Billing/CallCenter

E-CarOperationCenter

etc.

Communicationsinfrastructure

Fiberoptic/SHD/Ether.Power LineCarrierMicrowaveRouter/Switch

Fiberoptic/N/B PLC,WiMAXWIFI MeshCellularDSL, Rout. Switch

Fiberoptic/SDH/Ether.BPLCWiMAXWIFI MeshCellularRouter/ Switch

Fig. 8.1-2: Communication network solutions for Smart Grids



8

8.2 Communication Network Solutions for Transmission Grids (Communication Backbone)

8.2.1 Synchronous Digital Hierarchy (SDH)/Ethernet Solutions

For communications at transmission and subtransmission levels, Siemens offers the latest generation of SDH (Synchronous Digital Hierarchy) equipment, commonly referred to as NG (Next Gener ation) SDH (fig. 8.2-1).

NG SDH technology combines a number of benefits that make it well-suited to the needs of energy utilities. Among those bene-fits are high availability, comprehensive manageability and monitoring features, and last but not least SDH’s unique ability to seamlessly support both legacy applications and new, pri-marily packet-based emerging standards. Ethernet-over-SDH provides the capacity to transport packet-based traffic over the SDH backbone with high reliability and low latencies. As a result, Ethernet-over-SDH is the solution of choice for enabling IEC61850 across the entire communication backbone.

State-of-the-art NG SDH systems are highly integrated, providing all of the above-mentioned capabilities in a single device. In order to address the varying needs and requirements of the energy utilities, Siemens offers a wide range of products, from a single-board CPE to a multiservice platform for PDH (Plesiochro-nous Digital Hierarchy), SDH, WDM (Wavelength Division Multi-plexing), and Ethernet.

Benefits at a glanceHigh availabilityVery short delay times in protection signal transmissionFor both legacy and packet-based applications/systemsSupports IEC 61850 standardFull-spectrum network management system

PhonePhone RTURTU IEC 61850substation ring

IEC 61850substation ring

OPGW

AccessMUX

AccessMUX

OPGW

NMS

SubstationSubstation

Router

NGSDH

NGSDH

Controlcenter

Fig. 8.2-1: Typical Next Generation SDH solution for transmission grids


Communication Network Solutions for Smart Grids8.2 Communication Network Solutions for Transmission Grids (Communication Backbone)

8

8.2.2 Access Multiplexer

Today there is still a need to operate a number of different conventional communication interfaces in one substation (e.g., a/b phone, ISDN, V.24, X.21, etc.) and this will also apply in the near future. For this purpose, access multiplexers are used to bundle these communication signals and pass them on to the backbone system.

An access multiplexer can be employed to create flexible net-works which can react rapidly to changes in network require-ments. The modular design enables channel units to be com-bined as required for telephone, data and ISDN signal transmission. The multiplexer allows free assignment of user interfaces to the channels in the 2-Mbit/s signal and rapid configuration. Fig. 8.2-2 shows an overview of the interfaces provided by an typical access multiplexer.

AccessMultiplexer

Subscriber Side

2 Mbps G.703 / CAS

NGSDH

Data Interfaces

64 kbps, G.703 codirectionalV.24 / V.28, Subrates up to 64 kbpsV.35, Subrates up to 64 kbps or n x 64 kbpsV.36, Subrates up to 64 kbps or n x 64 kbps X.21 / V.11, Subrates up to 64 kbps or n x 64 kbps 10/100 BaseTn x 64 kbps, G.70364 kbps, G.703 centralized clockFractional E1, n x 64 kbps, 2 Mbps G.703

Voice interfaces

POTS, Subscriber Side, 2-wirePOTS, Exchange Side, 2-wire2-wire, Local battery2-wire VF and 2xE&M4-wire VF and 2xE&M2/4-wire VF

ISDN interfaces:

So-InterfaceUko-Interface, 2B1QUko-Interface, 4B3T

Fig. 8.2-2: Typical interfaces of an access multiplexer

8.2.3 PowerLink – Power Line Carrier for High-Voltage LinesThe digital power line carrier system PowerLink from Siemens uses the high-voltage line between substations as a communica-tion channel for data, protection signals and voice trans mission (table 8.2-1). This technology, which has been tried and tested over decades, and adapted to the latest standards, has two main application areas:

As a communication link between substations where a fiber-optic connection does not exist or would not be economically viable As backup system for transmitting the protection signals, in parallel to a fiber-optic link

Fig. 8.2-3 shows the typical connection of the PowerLink system to the high-voltage line via the coupling unit AKE 100, coupling capacitor.

Flexibility – the most important aspect of PowerLinkVersatility is one of the great strengths of the PowerLink system. PowerLink can be matched flexibly to your infrastruc-ture (table 8.2-2).

Multi-service devicePowerLink offers the necessary flexibility for transmitting every service the customer might want in the available band. All services can be combined in any way within the available band-width/bit rate framework.



8

Table 8.2-1: Progressive PLC technique with PowerLink

Application

Transmission of protection signals, telecontrolling information, data and voice via HV transmission lines

Advantages

Cost-effective for small to medium data volumes over long distances

Processes analog and digital signals

Adjustable transmission power

Variable bandwidth

Integrated TCP/IP interface

Voice compression

Versatile multiplexer

Integrated teleprotection systems

Cross-functional management system for all integrated services

Can be used effectively in combination withbroadband technologies for optimal availability

Bridge to IPIP functionality is best suited for the migration from TDM to packet-switched networks. PowerLink offers electrical and optical Ethernet interfaces, including an integrated L2 switch, extending the IP network to remote substations with a bit rate up to 320 kbps.

Optimal data throughput under changing environmental conditionsPowerLink adapts the data rate to changes in ambient condi-tions, thus guaranteeing maximum data throughput. Thanks to PowerLink’s integral prioritization function, which can be config-ured for each channel, routing of the most important channels is assured even in poor weather conditions.

Variable transmission powerThe transmission power can be configured via software in two ranges (20 – 50 W or 40 – 100 W), based on the requirements of the transmission path. This makes it easy to comply with national regulations and to enable optimized frequency plan-ning.

Maximum efficiency: The integrated, versatile multiplexer (vMUX)A large number of conventional communication interfaces today (e.g., a/b telephone, V.24, X.21, etc.) and in the foresee-able future must be operated in a switching station. For this purpose, PowerLink uses an integrated versatile multiplexer that

NMS

Phone RTU

Substation

Router

PowerLinkwith integrated

SWT 3000

PowerLinkwith integrated

SWT 3000

Phone RTUDistanceprotection

Distanceprotection

Router

Substation

Controlcenter

Fig. 8.2-3: PowerLink high-voltage line communication



8

bundles these communication forms together and transmits them by PLC. The vMUX is a statistical multiplexer with priority control. Asynchronous data channels can be transmitted in “guaranteed” or “best effort” modes, to guarantee optimum utilization of available transmission capacity. The priority con-trol ensures reliable transmission of the most important asyn-chronous and synchronous data channels and voice channels even under poor transmission conditions. Naturally, the vMUX is integrated in the management system of PowerLink, and is perfectly equipped for the power line communication require-ments of the future with extended options for transmitting digital voice and data signals.

Voice compressionVoice compression is indispensable for the efficient utilization of networks. Naturally, quality must not suffer, which is why PowerLink offers comprehensive options for adapting the data rate to individual requirements. PowerLink offers different compression stages between 5.3 and 8 kbit/s. To prevent any impairment of voice quality, the compressed voice band is routed transparently to PowerLink stations connected in line, without any further compression or decompression.

Protection signal transmission system SWT 3000A maximum of two independent SWT 3000 systems can be integrated into each PowerLink. Every integrated teleprotection system can transmit up to four protection commands. The command interface type for distance protection devices can be either standard binary or compliant with IEC 61850. Even a combination of both command interface types is supported. For highest availability, an alternate transmission path via a digital communication link can be connected. SWT 3000 systems are also fully integrated into the user interface of the PowerLink administration tool.

One administration system for all applicationsPowerLink not only simplifies your communications, but also makes communications cost-efficient. The PowerSys software administers all integrated applications of PowerLink under a standard user interface. This ensures higher operating security while cutting training times and costs to the minimum.

Integration of PowerLink in network management systems via SNMPPowerLink systems can also be integrated in higher level man-agement systems via the IP access by means of the SNMP pro-tocol (Simple Network Management Protocol). System and network state data are transferred, for example, to an alarm, inventory or performance management system.

Table 8.2-2: Overview of features

Features DigitalPLC

system

AnalogPLC

system

Universally applicable in analog,digital, or mixed operation

p p

Frequency range 24 kHz–1,000 kHz p p

Bandwidth selectable 2–32 kHz p p

Data rate up to 320 kbit/s at 32 kHz p

Transmission power 20/50/100 W, fine adjustment through software

p p

Operation with or without frequency band spacing with automatic cross talk canceller

p p

Digital interface

Synchronous X.21 (max. 2 channels)

Asynchronous RS 232 (max. 8 channels)

TCP/IP (2 x electrical, 1 x optical)

E1 (2 Mbps) for voice compression

G703.1 (64 kbps)

p

p

p

p

p

Analog interface

VF (VFM, VFO, VFS), max. 8 channels for voice, data, and protection signal

Asynchronous RS232 (max. 4) via FSK

p p

p

Miscellaneous

Adaptive dynamic data rate adjustment p

TCP/IP layer 2 bridge p

Integrated versatile multiplexer for voice and data

Max. 5 compressed voice channels via VF interface

Max. 8 voice channels via E1 interface

StationLink bus for the cross-connection of max. 4 PLC transmission routes (compressed voice and data without voice compression on repeater)

Reverse FSK analog RTU/modem data via dPLC (2 x)

p

p

p

p

p

Protection signal transmission system SWT 3000

Integration of two devices

Remote operation via cable or fiber-optic cable identical to the integrated version

Single-purpose or multipurpose/alternate multipurpose mode

p

p

p

p

p

p

Element manager, based on a graphical user interface for the control and monitoring of PLC and teleprotection systems

p p

Command interface binary and in accordance with IEC 61850

p p

Remote access to PowerLink

Via TCP/IP connection

Via in-band service channelp

p

p

p

SNMP compatibility for integrating NMS p p

Event memory with time stamp p p

Simple feature upgrade through software p p



8

8.2.4 SWT 3000 – Teleprotection for High-Voltage LinesThe SWT 3000 is an highly secure and reliable system for trans-mitting time-critical distance protection commands via analog and digital transmission channels (fig. 8.2-4). This enables faults in the high-voltage grid to be isolated selectively as quickly as possible. The SWT 3000 system can be integrated in the Power-Link system or be operated as a stand-alone system.

Security, reliability and speed of protection signal transmission is one of the central factors in the operation of high-voltage grids. For maximum operating reliability, SWT 3000 can be configured with two separately fed power supplies. If possible, protection signals should be transmitted over two alternative communica-tion paths to safeguard maximum transmission security. Fig. 8.2-5 shows the different analog and digital transmission paths between SWT 3000 systems.

The SWT 3000 also demonstrates its high degree of flexibility when existing substations are migrated to protection devices via the IEC 61850 communication standard. The SWT 3000 has all necessary command interfaces – both as binary interfaces and as GOOSE. This always keeps investment costs economically manageable, because the substations can be updated step by step for a new network age.

Fig. 8.2-4: SWT 3000 teleprotection system – overview

MUX PDH/SDH

Fiber optic

Pilot Cable

Power Line Carrier

Commandinterfaces

Line interfaces(Analog and Digital)

Binary I/O

GOOSE I/OIEC 61850

Binary I/O

SWT 3000 SWT 3000

GOOSE I/OIEC 61850

Commandinterfaces

Application

Transmission of protection signals to quickly identify, isolate and resolve problems in the transmission network of a utility

Advantages

Keeps downtimes to an absolute minimum

Supports IEC 61850 interfaces as well as conventional binary interfaces

Flexible integration into various customer communication networks

Path protection via two different transmission routes for increased reliability

6 9

11 12

14

Alternative transmission routesSWT 3000 enables transmission of protectionsignals via two different routes. Both routes areconstantly transmitting. In the event that oneroute fails, the second route still bears the signal.

7 8

9

Direct fiber-optic connection without repeaterSWT 3000 protection signaling incorporates aninternal fiber-optic modem for long-distancetransmission. The maximum distance betweentwo SWT 3000 devices is 150 kilometers.

9 10

12

Fiber-optic connectionbetween SWT 3000 and a multiplexerA short-distance connection of up to two kilometersbetween SWT 3000 and a multiplexer can berealized via the integrated fiber-optic modem accordingto IEEE C37.94. Alternately, the multiplexeris connected via FOBox, converting the opticalsignal to an electrical signal in case the MUX doesnot support C37.94.

13 14 SWT 3000 integration into the PowerLink –PLC systemThe SWT 3000 system can be integrated into thePowerLink equipment. Either the analog interfaceor a combination of the analog and the digital interfaces can be used.

3 Power line carrier connectionsThe analog link (CLE) between two SWT 3000devices can also be a PLC link. Depending ondevice configuration, SWT 3000 can be used withPowerLink in alternate multipurpose, simultaneousmultipurpose, or single-purpose mode.

4 12 Fiber-optic connectionsbetween SWT 3000 and PowerLinkA short-distance connection between an SWT 3000and Siemens’s PowerLink PLC terminal can be realizedvia an integrated fiber-optic modem. In thiscase, an SWT 3000 stand-alone system providesthe same advanced functionality as the versionintegrated into PowerLink. Each PowerLink can beconnected to two SWT 3000 devices via optical fibers.

5 6

7 11

SWT 3000 digital connectionsThe digital interface (DLE) permits protection signalsto be transmitted over a PDH or SDH network.

1 2 Pilot cable connectionsFor operation via pilot cable, two SWT 3000devices can be linked directly through the analoginterfaces (CLE).

Fig. 8.2-5: SWT 3000 transmission paths



8

1

4

2

3

SWT 3000FO

PowerLinkCSPFO

PowerLinkFOCSP

SWT 3000CLE

PowerLinkCSP

PowerLinkCSP

SWT 3000CLE

SWT 3000CLE

SWT 3000CLE EN 100

IFC

SWT 3000CLE EN 100

IFC

SWT 3000CLE EN 100

IFC

SWT 3000FO EN 100

IFC

4-wire link

2-wire link

Power line analog

Power line via optical fibers

EN 100IFC

EN 100IFC

EN 100IFC

EN 100IFC

Analog transmission

5

8

9

6

7

MUX

MUX

MUX

MUX

SWT 3000DLE EN 100

IFC

SWT 3000DLE EN 100

IFC

SWT 3000DLE

FP

EN 100IFC

SWT 3000DLEFO

FO

EN 100IFC

SWT 3000DLE

FO

EN 100IFC

SWT 3000FO

DLE

EN 100IFC

SWT 3000DLE

FO

EN 100IFC

SWT 3000FO

DLE

EN 100IFC

SWT 3000DLE

FO

EN 100IFC

SWT 3000DLE FO

FO

EN 100IFC

SWT 3000DLEEN 100

IFC

SWT 3000DLEEN 100

IFC

10

Digital network

Two routes via digital network

One path via fiber-optic cable; second path via digital network

Fiber-optic modem integrated

One path via integrated optical fibers; second via fiber-optic box, MUX, and digital network

Through digital network via MUX and fiber-optic C37.94

FOBox

SDH/PDH

SDH/PDH

SDH/PDH

SDH/PDH

SDH/PDH

Digital transmission

11SWT 3000

CLE

DLE

EN 100IFC

SWT 3000CLE

DLE

EN 100IFC

One path via digital network; second path via 4-wire (or 2-wire)

SDH/PDH

12MUX MUX

PowerLinkCSPFO

PowerLinkFOCSP SWT 3000

DLEFO

FO

EN 100IFC

SWT 3000DLE FO

FO

EN 100IFC

One path via power line and optical fibers; second path via optical fibers and digital network

FOBox FOBox

FOBox

SDH/PDH

Analog & digital transmission

14PowerLink

DLE EN 100IFC

PowerLinkDLEEN 100

IFC

One path via power line; second path via digital network

SDH/PDH

13PowerLinkEN 100

IFC

PowerLinkEN 100

IFCPower line

Integrated into PowerLink

PowerLink Power Line Carrier SystemIFC Interface Command BinaryDLE Digital Line EquipmentCLE Copper Line EquipmentPDH Plesiochronous Digital Hierarchy

EN 100 Interface IEC 61850SDH Synchronous Digital HierarchyFOBox Fiber-Optic BoxFO Fiber-Optic ModuleMUX Multiplexer



8

8.2.5 Coupling Unit AKE 100

The PLC terminals are connected to the power line via coupling capacitors, or via capacitive voltage transformers and the cou-pling unit. In order to prevent the PLC currents from flowing to the power switchgear or in other undesired directions (e.g., tapped lines), traps (coils) are used, which are rated for the operating and short-circuit currents of the power installation and involve no significant loss for the power distribution system.

The AKE 100 coupling unit from Siemens described here, together with a high-voltage coupling capacitor, forms a high-pass filter for the required carrier frequencies, whose lower cut-off frequency is determined by the rating of the coupling capacitor and the chosen matching ratio.

The AKE 100 coupling unit is supplied in four versions and is used for:

Phase-to-earth coupling to overhead power lines Phase-to-phase coupling to overhead power lines Phase-to-earth coupling to power cables Phase-to-phase coupling to power cables Intersystem coupling with two phase-to-earth coupling units

The coupling units for phase-to-phase coupling are adaptable for use as phase to-earth coupling units. The versions for phase-to-earth coupling can be retrofitted for phase-to-phase coupling, or can as well be used for intersystem coupling.

8.2.6 Voice Communication with PowerLinkThe TCP/IP protocol is gaining increasing acceptance in the voice communication area. However, considerably higher bandwidth requirements must be taken into account in network planning with VoIP compared with analog voice links. Table 8.2-3 shows the bandwidth requirement for a voice link via TCP/IP as a func-tion of the codec used for voice compression.

In the office area today, the LAN infrastructure is usually suffi-ciently generously dimensioned to make VoIP communication possible without any restrictions. The situation is distinctly different if it is necessary to connect distant substations to the utility’s voice network. If these locations are not integrated in the corporate backbone network, Power Line Carrier connections must be installed. Fig. 8.2-6 shows the basic alternatives for voice communication via PowerLink.

Table 8.2-3: Bandwidth requirement for VoIP

Codec Net bit rate Gross bit rate

G.711 64 kbit/s 87.2 kbit/s




G.723.1 5.3 kbit/s 20.8 kbit/s

Router

PABXE&M

Digital interface

TCP/IP

TCP/IP interface

Analoge interface

Analoge interface

Analog connectionof single phones

Connection of phonesor PABXs via TCP/IP

Analog connectionof PABXs

Digital connectionof PABXs

a/b

PowerLink

PowerLink

PowerLink

PowerLink

PABXfE1

PABX

Fig. 8.2-6: Basic options of voice communication via PowerLink



8

Analog connectionThe telephone system is connected to the PowerLink via the analog E&M interface. A telephone system or an individual analog telephone can also participate in a PowerLink system at a different location. The bandwidth requirement can be reduced to about 6 kbit/s (including overhead) per voice link by means of voice compression in the PowerLink.

Digital connectionWith digital connection, the telephone system is connected to PowerLink via the digital E1 interface. Because of the restricted bandwidth, up to 8 of the 30 voice channels (Fractional E1) can be used. This alternative is only suitable for communication between telephone systems. Individual telephones must be connected locally to the particular telephone system. The band-width requirement is made up of the user data per voice channel (e.g., 5.3 kbit/s) and the D-channel overhead for the entire E1 link (approximately 2.4 kbits/s), (i.e., for a voice channel less than 10 kbit/s).

In the case of series connected locations with both analog and digital connection, multiple compression/decompression of the voice channel is prevented by the unique PowerLink function “StationLink”.

Proven in 80 countries with over 25 million ports sold

Cost-effective communication choicesfor converged IP telephony

Built-in reliability

Scalable architecture

Flexible deployment options

Easy migration

Great migration investment protection

Open interfaces

Comprehensive support services

Mature and stable company

The Leading Converged IPCommunication SolutionHiPath 4000

DECT

HiPath 4000

Analog

TDM IPDA

SoftGateITInfrastructure

(IP)

PSTN

VolP Phones

Fig. 8.2-7: HiPath 4000 overview

TCP/IP connectionThe telephone system, voice terminals and the PowerLink system are connected directly to the TCP/IP network. Voice communica-tion is conducted directly between the terminals. Only control information is transmitted to the telephone system. Use of the TCP/IP protocol results in a broadband requirement per voice channel of at least 21 kbit/s (5.3 kbit/s voice plus TCP/IP over-head).

Telephone systemsTo ensure the operation along high-voltage transmission lines or pipelines and power plants, voice communication is an impor-tant part of the entire solution. The Siemens Enterprise Commu-nication portfolio addresses all the different requirements of util-ities, and can be deployed in various scenarios.

The limited bandwidth availability of Power Line Carrier systems in the high-voltage area will ensure an important role for con-ventional telephone systems (e.g., HiPath 4000) with analog interfaces in this segment in the future as well (fig. 8.2-7).



8

8.2.7 Live Line Installation of OPGW (Optical Ground Wire)The transformation of power supply systems into Smart Grids is closely related to the growing communication requirements (bandwidth demand) in the transmission and distribution areas.

To allow for quick data transfers between large substations in the transmission system, fiber-optic cables are being used to replace ground wires on high-voltage lines (OPGW: Optical Ground Wire).

As a result of the growing and often unpredictable feeding of energy into the power supply system by decentralized generators, it is becoming increasingly difficult and sometimes impossible for transmission companies to shut off line segments for instal-lation measures to improve the communication infrastructure.

The Siemens Live Line Installation process makes it possible to perform such installations or repairs on energized power lines. This installation concept was developed in a joint effort by Siemens and a team at Dresden University in Germany.

The Siemens Live Line Installation process can be used for the following purposes:

To replace the ground wire with an optical ground wire, in order to provide broadband communication even to smaller substations Additional installation of a second optical ground wire below the top of the tower, on especially communication-intensive segments To replace an obsolete or defective optical ground wire.

Safety of both personnel and equipment is the utmost priority: Live Line Installation supplies a new earthing concept as well as pulling machines and brakes on the ground (fig. 8.2-8).

With live line installation, optical ground wires can be installed either directly at the top of the tower or below the top between the power-carrying lines (fig. 8.2-9).

Special security precautions are taken when high-risk areas (highways, bodies of water, railways, etc.) are to be crossed when installing the optical ground wires below the top of the tower.

During live line installation, the existing ground wire serves as a messenger and carries all the installation equipment, such as pulleys, the full dielectric prepulling rope and the OPGW itself.Thus, the new hybrid cable can be pulled from tower to tower across the entire delivery length. In high-voltage lines, the usual delivery length is approximately 4 km.

Siemens is the most experienced and most successful supplier of live line installation of optical ground wires on high-voltage lines worldwide, and conducted the first live line installation already in the year 2000.

Fig. 8.2-8: Live line installation of optical ground wire

Substation Substation

OPGW

Automationprocesses

Automationprocesses

Corporate networkbackbone

Corporate networkbackbone

TransparentEthernet channels

for 3rd parties

Splice box

Dark fibreleasing

Dark fibreleasing

2nd OPGW

Splice Box

Fibrer-optictermination box

Fibrer-optictermination box

ODF ODF

OFTB OFTB OFTB OFTB

Bac

kbo

ne

com

mu

nic

atio

nvi

a O

PGW

Tr

ansm

issi

on

su

bst

atio

ns

NGSDH

NGSDH

TransparentEthernet channels

for 3rd parties

Fig. 8.2-9: Live line installation of OPGW – installation alternatives


8


8.3 Control Center Communication

Redundant control center communicationA control center for power supply systems such as Spectrum Power (fig. 8.3-1) is typically configured with full redundancy to achieve high availability. This includes communications. Depending on the system operator’s requirements, various mechanisms are supported to achieve this goal for communica-tion. This includes:

Automatic failover of communication servers Configurable load sharing between two or more communication servers Automatic failover of communication lines Supervision of standby communication line, including telegram buffering

Process communication to substations and power plantsProcess communication to the substations and to Remote Terminal Units (RTUs), e.g., in power plants or power supply systems, is implemented via serial interfaces or by means of TCP/IP-based network communication with a Communication Front End. The Communication Front End includes data-pre-processing functionality like :

Routine for data reduction, e.g., old/new comparison, threshold check Data conversion Scaling and smoothing of measured values Integrity checks for incoming data Data completeness checks and cycle monitoring Statistical acquisition of the data traffic with the RTU.

All kinds of different protocols are used for historical reasons. However, as a result of international standardization there is also a market trend here towards standardized protocols like IEC 60870-5-104, DNP3i protocol or IEC-61850.

The more recent protocol standards all rely on TCP/IP-based communication. However, it must be possible today and in the near future to continue connecting conventional telecontrol devices (already installed RTUs) via serial interfaces.

Interface for industry automation/third-party applicationsOPC (OLE for process control) and OPC UA provide a group of defined interfaces. OPC in general enables the overall data exchange between automation and control applications, field systems/field devices, as well as business and office applications.

OPC is based on OLE/COM and DCOM technology. OPC UA (Uni-fied Architecture) is a continuation and further innovation of OPC. OPC UA is based on native TCP/IP and is available for mul-tiple operating system platforms, including embedded devices.

Communication between control centersThe communication between control centers is provided via the communication protocols ICCP or ELCOM, and is based on TCP/IP.

The Inter Control Center Communication Protocol (ICCP) is an open and standardized protocol based on IEC 60870-6 and Telecontrol Application Service Element Two (TASE.2).

The exchanged data is primarily real-time system information like analog values, digital values and accumulator values, along with supervisory control commands.

Remote workstations/office communicationRemote workstations can communicate with the control center via the office LAN or an Internet connection. System and data integrity has to be ensured by the system security configuration for

Protection against external attacksProtection against unauthorized usageProtection against data loss

Fig. 8.3-1: Typical communication interfaces and communication partners of a control center using the example of Spectrum Power™

CFEELCOMICCP

OPCRTU

Communication Front EndElectricity Utilities CommunicationInter Control CenterCommunication ProtocolOLE for Process ControlRemote Terminal Unit

Internet/Office LAN

Officecommunication

Webuser interface

TCP/IP

Firewall

Control Center, e.g., Spectrum Power™ (SCADA, Applications)

Communication bus

CFE OPCICCP

ELCOM

Differenttelecontrol

protocols viaserial interface

IEC 60870 protocolfamily (101, 104, DNP3)IEC 61850, etc. via serialinterface or TCP/IP

Automation protocols(SIMATIC NET via TCP/IP forlong distances, Profibusonly for short distances)

Inter controlcentercommunicationvia TCP/IP

SICAM PAS,SICAM RTU

Utility substation

Industrialautomation,

3rd party applicationsControl center

Telecontroldevices:

RTUs

456 Siemens Energy Sector • Power Engineering Guide • Edition 7.0

8


8.4 Substation Communication

8.4.1 Overview of IEC 61850

Since being published in 2004, the IEC 61850 communication standard has gained more and more relevance in the fi eld of substation automation. It provides an effective response to the needs of the open, deregulated energy market, which requires both reliable networks and extremely fl exible technology – fl ex-ible enough to adapt to the substation challenges of the next twenty years. IEC 61850 has not only taken over the drive of the communication technology of the offi ce networking sector, but it has also adopted the best possible protocols and confi gura-tions for high functionality and reliable data transmission. Industrial Ethernet, which has been hardened for substation purposes and provides a speed of 100 Mbit/s, offers bandwidth enough to ensure reliable information exchange between IEDs (Intelligent Electronic Devices), as well as reliable communica-tion from an IED to a substation controller.

The defi nition of an effective process bus offers a standardized way to connect conventional as well as intelligent CTs and VTs to relays digitally. More than just a protocol, IEC 61850 also provides benefi ts in the areas of engineering and maintenance, especially with respect to combining devices from different vendors.

Key features of IEC 61850As in an actual project, the standard includes parts describing the requirements needed in substation communication, as well as parts describing the specifi cation itself.

The specifi cation is structured as follows:• An object-oriented and application-specifi c data model focused

on substation automation.• This model includes object types representing nearly all

existing equipment and functions in a substation – circuit-breakers, protection functions, current and voltage transformers, waveform recordings, and many more.

• Communication services providing multiple methods for information exchange. These services cover reporting and logging of events, control of switches and functions, polling of data model information.

• Peer-to-peer communication for fast data exchange between the feeder level devices (protection devices and bay controller) is supported with GOOSE (Generic Object Oriented Substation Event).

• Support of sampled value exchange.• File transfer for disturbance recordings.• Communication services to connect primary equipment such

as instrument transducers to relays.• Decoupling of data model and communication services from

specifi c communication technologies.• This technology independence guarantees long-term stability

for the data model and opens up the possibility to switch over

to successor communication technologies. Today, the standard uses Industrial Ethernet with the following signifi cant features:

– 100 Mbit/s bandwidth – Non-blocking switching technology – Priority tagging for important messages – Time synchronization

• A common formal description code, which allows a standardized representation of a system’s data model and its links to communication services.

• This code, called SCL (Substation Confi guration Description Language), covers all communication aspects according to IEC 61850. Based on XML, this code is an ideal electronic interchange format for confi guration data.

• A standardized conformance test that ensures interoperability between devices. Devices must pass multiple test cases: positive tests for correctly responding to stimulation telegrams, plus several negative tests for ignoring incorrect information

• IEC 61850 offers a complete set of specifi cations covering all communication issues inside a substation

• Support of both editions of IEC 61850 and all technical issues.

8.4.2 Principle Communication Structures for Protection and Substation Automation Systems

SIPROTEC – communication of protection relays and bay controllersCommunication interfaces on protection relays are becoming increasingly important for the effi cient and economical operation of substations and networks.

The interfaces can be used for:• Accessing the protection relays from a PC using the DIGSI

operating program for aspects of confi guration, access of operational and non-operational data.

Remote access via modem or Ethernet modem is possible with a serial service port at the relay. This allows remote access to all data of the protection relay.

By using the remote communication functions of DIGSI it is possible to access relays, e.g., from the offi ce via the telephone network (fi g. 8.4-1). For example, the error log can be trans-ferred to the offi ce and DIGSI can be used to evaluate it.• Integrating the relays into control systems with IEC 60870-5-

103 protocol, PROFIBUS DP protocol, DNP 3.0 protocol and MODBUS protocol.

The new standardized IEC 61850 protocol (section 8.3.1) has been available since October 2004, and with its SIPROTEC units Siemens was the fi rst manufacturer worldwide to provide this standard.• Thanks to the standardized interfaces IEC 61850, IEC 60870-5-



8


103, DNP 3.0 (serial or over IP), MODBUS, PROFIBUS DP, SIPROTEC units can also be integrated into non-Siemens systems or in SIMATIC S5/S7. Electrical RS485 or optical interfaces are available. The optimum physical data transfer medium can be chosen thanks to opto-electrical converters. Thus, the RS485 bus allows low-cost wiring in the cubicles and an interference-free optical connection to the master can be established. Peer-to-peer communication of differential relays and distance relays (section 8.5.2) to exchange real-time protection data via fiber-optic cables, communication network, telephone networks or analog pilot wires.

Ethernet-based system with SICAMSIPROTEC is tailor-made for use with the SICAM power automa-tion system together with IEC 61850 protocol. Via the 100 Mbit/s Ethernet bus, the units are linked electrically or optically to the station unit. Connection may be simple or redundant. The inter-face is standardized, thus also enabling direct connection of units from other manufacturers to the LAN. Units featuring an IEC 60870-5-103 interface or other serial protocols can be con-nected via the Ethernet station bus to SICAM by means of serial/Ethernet converters. DIGSI and the Web monitor can also be used over the same station bus. Together with Ethernet/IEC 61850 an interference-free optical solution can be provided. Thus, the installation Ethernet interface in the relay includes an Ethernet switch. Thus, the installation of expensive external Ethernet switches can be avoided. The relays are linked in an optical ring structure (fig. 8.4-2).

Further communication options for IED connectionApart from supporting IEC 61850, modern substation automa-tion systems like SICAM also support the connection of IEDs (Intelligent Electronic Devices) with other protocol standards like the well-known standard IEC 60870-5-103 for protections units as well as DNP3 (serial or over IP), and also protocols such as PROFIBUS DP and MODBUS.

Specifically with SICAM PAS, the devices with serial commu-nication can be reliably connected directly to the substation controller. Moreover it is also possible to use LAN for backbone communication throughout the substation, connecting such serial devices with serial hubs in a decentralized approach.

Additionally it is also possible to connect subordinated substations and Remote Terminal Units (RTU) using the protocol standards IEC 60870-5-101 (serial communication) and IEC 60870-5-104 (TCP/IP).

Especially for communication with small RTUs, dial-up connections can be established based on IEC 60870-5-101.

Additional features of TCP/IP communicationBesides the traditional protocols mentioned for data exchange with IEDs, in the world of Ethernet it is also important to be aware of the status of communication infrastructure devices such as switches. In this context, the protocol SNMP (Simple Network Management Protocol) helps a lot. SICAM PAS supports

this protocol, thereby providing status information, e.g., to the control center, not only for IEDs and substation controllers, but also for Ethernet switches and other “SNMP devices”.

Another communication protocol, well-known from the indus-trial automation sector, is also required for substation automa-tion applications: OPC (OLE for Process Control, see also Control Center Communication). Additional interoperable solutions are possible with OPC, especially for data exchange with devices and applications of industrial automation. SICAM PAS supports both OPC server and OPC client.

The linking of protection relays and/or bay controllers to the station level is chosen according to the size and importance of the substation. Whereas serial couplings with IEC 60870-5-103

Signalconverter7XV5650

Office

Modem/Ethernetmodem

Analog/ISDN/

Ethernet

Modemoptionallywithcall-backfuction

Ministar-coupler7XV5450

DIGSI

DIGSI

PC, remotelylocated

PC, centrallylocated in thesubstation(option)

7SJ60 7RW60 7SD60

RS485 Bus

7**6 7**6

opt.

RS485

Fig. 8.4-1: Basic remote relay communication

Switch

max. 6 relaysper switch

SIPROTEC relays with IEC 61850 protocol and Ethernet interface

SIPROTEC relays with serial IEC 60870-5-103 protocol

Serial Ethernetconverterserial hubIEC 60870-103protocol

Switch

SE

Switch

Ethernet cable

SICAMStation unit

Fig. 8.4-2: Ethernet-based system with SICAM



8


are the most economical solution in small distribution substa-tions (only medium voltage), Ethernet in compliance with IEC 61850 is normally used for important high-voltage and extra-high-voltage substations. In addition there are a number of different physical designs, based on the local situation as regards cable runs and distances, and on the requirements in terms of availability and EMC influences.

The simplest version is the serial bus wiring in accordance with RS 485 in which the field devices are electrically connected to a master interface on the SICAM central unit (fig. 8.4-3). This wiring is particularly recommended in new installations. Special

attention should also be paid to correct handling of the earthing, and also to possible impact on the EMC due to the primary technology or power cables. Separate cable routes for power supply and communications are an essential basis for this. A reduction of the number of field devices per master to about 16 to 20 devices is recommended in order to be able to make adequate use of the data transfer performance.

A star configuration of the wiring is rather easy to handle and can be in the form either of electrical wiring as per RS 232, or optical fiber. Here again, the number of devices per master should be limited as before (fig. 8.4-4).

Control center

IEC 60870-5-101 or -104

SICAM

SIPROTEC

IEC 60870-5-103 (RS 485)

ConverterRS 485/232

Fig. 8.4-3: Serial bus wiring in accordance with RS 485

Control center

IEC 60870-5-101 or -104

SICAM

Starcoupler

SIPROTEC

IEC 60870-5-103

Fig. 8.4-4: Star wiring in accordance with RS 232 or per fiber-optic cable

SwitchSwitch

Fig. 8.4-5: Ethernet: Star configuration electrical or optical

Switch Switch Switch

Switch

SICAM

Fig. 8.4-6: Ethernet: Optical ring with external switches



8


The configurations with Ethernet are similar, with star and ring versions available. Variants with redundancy complete these configurations. The star configuration is especially recom-mended for central arrangements with short distances for the cable routes (fig. 8.4-5).

A fiber-optic ring can be made up of individual switches. That is especially advisable if several devices are to be connected in each feeder (fig. 8.4-6).

A more economical solution is the fiber-optic ring with SIPROTEC relays because these devices have a switch directly integrated

(fig. 8.4-7). In this application, though, a suitable device from RuggedCom must be used for the central switch so that the fast switchover times can also be used in the case of a malfunction on the ring. The number of devices in the ring is restricted to 27.

Several rings can also be combined on the basis of this funda-mental structure, e.g., one per voltage level. Usually these rings are combined to form a higher level ring which then communicates with redundant station devices. This version offers the highest availability for station-internal communica-tion (fig. 8.4-8).

Switch

SICAM

Fig. 8.4-7: Optical ring with integrated switches

SwitchSwitch

SwitchSwitchSwitchSwitch

SwitchSwitch

EHV HV

SwitchSwitch

MV

Fig. 8.4-8: The combination of several rings offers the highest availability

460 Siemens Energy Sector • Power Engineering Guide • Edition 7.0


8


Fig. 8.4-12: CB202: expansion modules with communication modules and analog input module

8.4.3 Multiple Communication Options with SIPROTEC 5The SIPROTEC 5 modular concept ensures the consistency and integrity of all functionalities across the entire device series. Signifi cant features here include:

Powerful and fl exible communication is the prerequisite for distributed and peripheral system landscapes. In SIPROTEC 5 this is a central element of the system architecture enabling a wide variety of communication requirements to be satisfi ed while providing utmost fl exibility. Fig 8.4-11 shows a possible hard-ware confi guration equipped with 4 communication modules. Fig 8.4-12 shows the CB202 expansion module with 3 slots for plug-in modules. Two of these slots can be used for communica-tion applications.

Owing to the fl exibility of hardware and software, SIPROTEC 5 features the following system properties:• Adaptation to the topology of the desired communication

structure, such as ring or star confi gurations• Scalable redundancy in hardware and software (protocols)• Multiple communication channels to various superordinate

systems• Pluggable communication modules that can be retrofi tted• The module hardware is independent of the communication

protocol used• 2 independent protocols on a serial communication module• Up to 8 interfaces are available• Data exchange via IEC 61850 for up to 6 clients using an

Ethernet module or the integrated Ethernet interface.

Fig. 8.4-11: SIPROTEC 5 device with 4 communication module



8


Communication examples with SIPROTEC 5Regardless of the desired protocol, the communication tech-nology used enables communication redundancies to be tailored to the requirements of users. They can basically be divided into Ethernet and serial communication topologies.

ProtocolsSerial protocolsEthernet protocols

Different degrees of protocol redundancy can be implemented. The 4 plug-in module slots limit the number of independent protocol applications that run in parallel. For serial protocols, 1 or 2 masters are usually used.

Serial protocolsRedundant or different serial protocols are capable of running simultaneously in the device, e.g., DNP 3 and IEC 60870-5-103. Communication is effected to one or more masters.

Two serial protocols can run on a double module (fi g 8.4-13). It is not relevant in this context whether these are two protocols of the same type or two different protocols.

The communication hardware is independent of the required protocol. This protocol is specifi ed during parameterization with DIGSI 5.

Ethernet protocolsThe Ethernet module can be plugged in once or multiple times in the device. This enables running identical or different protocol applications in multiple instances. Multiple networks are pos-sible for IEC 61850 or DNP3 TCP, but they can also be operated in a common Ethernet network. A module implements the IEC 61850 protocol application, e.g., the data exchange between devices using GOOSE messages. The other module is responsible for the client-server communication over the DNP TCP protocol. The client-server architecture of IEC 61850 enables one server (device) to send reports to up to 6 clients simultaneously. In this case, only one network is used.

Fig. 8.4-13: Serial optical double module

Fig. 8.4-14: Optical Ethernet module



8


ExamplesRedundancies to substation automation systems

2 redundant substation automation systems2 different substation automation systems.

Example 1: Two redundant substation automation systemsFig. 8.4-15 show shows a serial optical network which connects the serial protocol interfaces of the device to one master, respec-tively. Transmission is accomplished in multipoint-star configura-tion and with interference-free isolation via optical fiber.

For the IEC 60870-5-103 protocol, the device supports special redundancy procedures. For instance, a primary master can be configured that is preferred to the second master in control direction. The current process image is transmitted to both masters.

The fig. 8.4-16 describes a fully redundant solution based on IEC 61850. 2 Ethernet communication modules are plugged into each SIPROTEC 5 device. 2 redundant fiber-optic rings are set up by means of the switches integrated in the module and con-nected to the redundant clients (substation automation sys-tems). Alternatively, the redundant IEC 61850 communication could also be accomplished via a common optical ring.

SIPROTEC 5

IEC 60870-5-103/DNP3

Master

IEC 60870-5-103/DNP3

Master

IEC 103 via serialdouble moduleor independentserial modules

Star coupler Star coupler

Device 1 Device 2 Device n

Serial connections

Fig. 8.4-15: Redundant IEC 60870-5-103 or DNP 3 communication

IEC 61850,DNP3 TCP

Client

Switch

Switch Switch

SIPROTEC 5Device nDevice 1

IEC 61850,DNP3 TCP

Client

Switch

Device 2

Fig. 8.4-16: Redundant communication to two IEC 61850 or DNP3 TCP clients



8


Redundant substation control connection

Reporting/control

Ethernet ring

Switch

Switch Switch

SIPROTEC 5

GOOSE

Fig. 8.4-19: Separate buses for reporting and GOOSE communication

Example 2: Two substation automation systems with different protocolsSince both the serial protocols and the Ethernet-based protocols are only specified during parameterization, the configuration described previously can also be implemented using mixed protocols. This can be a particularly interesting case of applica-tion if different control centers are connected via different protocols. This could be, for example, the control center of the transmission system and the control center of the distribution system. Fig. 8.4-17 and fig. 8.4-18 show a possible combination.

DIGSI

Substation controllerIEC 61850 Client

Substation controllerIEC 60870-5-103 Master

Serial opticalUSARTmodule

Client-Server communicationvia the integrated Ethernetinterface

Ethernetswitch

DIGSI 5

SwitchStar coupler

Fig. 8.4-17: Communication to IEC 61850 client and serial connection to an IEC 61870-5-103 master

DIGSI

Substation controllerDNP3 TCP Slave

Substation controllerDNP3 Master

Serial opticalUSARTmodule

Client-Server communicationvia the integrated Ethernetinterface

Ethernetswitch

DIGSI 5

SwitchStar coupler

Fig. 8.4-18: Communication to DNP3 TCP slave and serial connection to an DNP3 master

Multiple substations busesSubstation-wide Ethernets are increasingly being used in modern substation automation systems in practice. These networks transport both the communication services to the central substation computer controller and the signals between the devices of the bay level. Usually, a single Ethernet subsystem is set up for this purpose since the bandwidth of today’s Eth-ernet networks is sufficient for the entire data traffic.

By using multiple communication modules and protocols in SIPROTEC 5 it is now possible to set up several subsystems, and to separate the different applications. For example, a separate process bus for process signals (GOOSE) could be implemented on bay level, and a separate bus to the central substation com-puter. See fig. 8.4-19 (2 substation buses).



8


8.4.4 Network Redundancy Protocols

Today’s configuration of a substation network – RSTPThe electrical and optical Ethernet modules of SIPROTEC devices support different network topologies. This applies independently of the selected protocol (IEC 61850 or DNP TCP).

If the module operates in dual homing redundancy (without integrated switch), it can be connected to external switches either in simple or redundant configuration. Only one interface at a time processes the protocol applications (e.g., IEC 61850) in this case. The second interface operates in standby mode (hot standby), and the connection to the switch is monitored. If the interface which processes the protocol traffic fails, the standby interface is activated within a few milliseconds and takes over) – (fig. 8.4-20).

When activating the integrated switch, SIPROTEC devices can be integrated directly into the optical communication ring con-sisting of up to 40 devices (fig. 8.4-21). In this case, both inter-faces of the module send and receive at the same time. The ring redundancy procedure Rapid Spanning Tree Protocol (RSTP) ensures short switchover times if the communication is inter-rupted, allowing the protocol applications to continue operation virtually without interruption. This configuration is independent of the protocol application running on the Ethernet module.

Today, more than 250,000 Siemens devices in more than 3,000 substations are in operation worldwide in stations with RSTP. In case of ring interruptions, RSTP reconfigures the communication within a short time, and provides a secure operation of substa-tions.

Seemless redundancy PRP and HSRNew technologies reduce the time for reconfiguration of communication networks in case of interruptions to about nothing. These technologies are:

PRP = Parallel Redundancy ProtocolHSR = High Available Seamless Ring Redundancy

Both systems have the same principle and are specified in IEC 62439-3.

The same information (Ethernet frame) is being sent over two ways. The receiver takes the first that comes in and discards the second one. If the first does not get through, the second one is still available and will be used. The mechanism is based deeply in the Ethernet stack, means one MAC and one IP address for both.

PRP uses two independent Ethernet systems. This means double amount of network equipment and respectively cost, but it is simple. HSR is using the same principle, but in one Ethernet network in a ring configuration. The same information (Ethernet frame) will be sent in the two directions into the ring, and the receiver gets it from the two sides of the ring. This means some more effort in the devices but saves the costs for a second Ethernet network.

Switch

Switch Switch

SIPROTEC 5 SIPROTEC 5 SIPROTEC 5 SIPROTEC 5

Fig. 8.4-20: Redundant or single star connection to external switches (dual homing redundancy)

Redundant substation control connection

Ethernet ring

Switch

Switch Switch

SIPROTEC 5

Fig. 8.4-21: Operation with integrated switch and ring redundancy

Switch 1 Switch 2

RSTP-Switch

NonRSTP IED

FastEthernetRSTP

Ring structure

FastEthernetRSTP

Optical ring

Fig. 8.4-22: Example of an RSTP solution



8


Switch

Switch

Switch

Switch

Switch

SwitchPRP-B

PRP-B

non HSR devices

A

Redbox

RB

RB

RB

RB

RB

RB

B

Switch

SwitchSwitch

Switch

RB = Redbox

Fig. 8.4-24: Seamless redundancy by use of PRP/HSR combined

Switch

Switch

Switch

Switch

Switch

Switch

SwitchSwitch

Switch

Switch

Switch

Switch

Switch

Switch

Switch Switch

SwitchSwitch

PRP-B

PRP-B

A

A

Redbox

B

B

Fig. 8.4-23: Seamless redundancy by use of PRP only



8


PRP-B

PRP-A

non HSR devices

up to 50 devices on the ringA

Redbox

RB

RB

RB

RB RB

RB

B

Switch

Switch

RB = Redbox

Switch

Switch

Fig. 8.4-25: Most cost-effective seamless n-1 structure

HSR and PRP can be combined by so called RedBoxes (Redun-dancy Boxes).

The figs. 8.4-23 to 8.4-25 show some examples of PRP and HSR configurations.

This cost-effective solution of fig. 8.4-25 can be achieved by:2 switches at the control room2 switches in the field2 Redboxes (RB) per HSR ringUp to 50 devices per HSR ringEasy expansion by additional 2 PRP switches

SummarySiemens offers redundancy solutions– Dual link redundancy– RSTP– PRP (seamless)– HSR (seamless)Dual link and RSTP: Field proven established technologyPRP: High level redundancy through double network solution HSR: High level redundancy through cost effective ring network structure. Combinable with PRP network. Siemens Seamless Ethernet Media Redundancy Suite: SICAM PAS, SIPROTEC and Redbox SIPROTEC with integrated RSTP/PRP/HSR switches

–> Siemens solutions produce significant user advantage

in terms of functionality.

467Siemens Energy Sector • Power Engineering Guide • Edition 7.0


8


8.4.5 Communication Between Substation Using Protection Data Interfaces

SIPROTEC 4 – differential and distance protectionTypical applications of differential and distance protection are shown in fi g. 8.4-26. The differential protection relay is con-nected to the current transformers and to the voltage trans-formers at one end of the cable, although only the currents are required for the differential protection function. Direct connec-tion to the other units is effected via single-mode fi ber-optic cables and is thus immune to interference. Various communica-tion modules are available for different communication media. In the case of direct connection via fi ber-optic cables, data communication is effected at 512 kbit/s and the command time of the protection unit is reduced to 15 ms.

SIPROTEC 4 offers many features to reliably and safely handle data exchange via communication networks. Depending on the bandwidth available, a communication converter for G703-64 kbit/s or X21-64/128/512 kbit/s can be selected. For higher communication speed, a communication converter with G703-E1 (2,048 kbit/s) or G703-T1 (1,554 kbit/s) is available.

820 nmmax.1.5 km

X21G703.1

Communicationconverter

Communicationconverter

200 km overhead line, 400 kV

Digitalcommunication

network

7SD6107SA6

7SD6107SA6

Fig. 8.4-27: Protection Data Interface using digital communication networks

7SD6107SA6

7SD6107SA6

10 km overhead line, 110 kV cable

Multi-mode FO 62.5/125 mmModule 1: 1.5 km ST connectorsModule 2: 3.5 km ST connectors

Single-mode FO 9/125 mmModule 3: 24 km LC connectorsModule 4: 60 km LC connectorsModule 4: 100 km LC connectors

Fig. 8.4-26: Protection Data Interface using direct FO connection

Teleprotection using protection data interfaceThe teleprotection schemes can be implemented using digital serial communication. The distance protection SIPROTEC 7SA6 is capable of remote relay communication via direct links or multi-plexed digital communication networks. The link to a multi-plexed communication networks is made by separate communi-cation converters (7XV5662). These have a fi ber-optic interface with 820 nm and ST connectors to the protection relay. The link to the communication networks is optionally an electrical X21 or a G703.1 interface (fi g. 8.4-27).

SIPROTEC 5 – transfer of data via the protection interfaceThe protection interface and protection topology enable data exchange between the devices via synchronous serial point-to-point links from 64 kbit/s to 2 Mbit/s. These links can be established directly via optical fi bers or via other communication media, e.g., via dedicated lines or communication networks.

A protection topology consists of 2 to 6 devices, which communicate point to point via communication links. It can be structured as a redundant ring or as a chain structure (see fi g. 8-4.20), and within a topology the protection links can have different bandwidths. A certain amount of binary information and measured values can be transmitted bi-directionally between the devices depending on the bandwidth. The connec-tion with the lowest bandwidth determines this number. The user can route the information with DIGSI 5.

This information has the following tasks:• Topology data and values are exchanged for monitoring and

testing the link• Protection data, for example differential protection data or

direction comparison data of the distance protection, is transferred.

• Time synchronization of the devices can take place via the link, in which case a device of the protection topology assumes the role of timing master.

• The link is continuously monitored for data faults and failure, and the runtime of the data is measured.

Protection links integrated in the device have previously been used for differential protection (fi g. 8-4.26) and for teleprotec-tion of the distance protection. In addition to these protection applications, you can confi gure protection links in all devices in SIPROTEC 5. At the same time, any binary information and measured values can be transferred between the devices. Even connections with low bandwidth, e.g., 64 kbit/s can be used for this.

Use of the protection link for remote access with DIGSI 5Access with DIGSI 5 to devices at the remote ends is possible via the protection interface. This allows devices at the remote ends to be remotely read out, or parameters to be set using the existing communication connection.



8


52 52

o eoePI PI

2 km with 62.5 μm/125 μmmulti-mode optical fiber

Module type:USART-AD-1FOUSART-AE-2FO

USART-AD-1FOUSART-AE-2FO

Communication converterX21

G703.1

Com-munication

network

SIPROTEC 5 SIPROTEC 5

Fig. 8-4.29: Protection communication via a communication network with X21 or G703.1 (64 kbit/s), G703.6… (2 Mbit) interface

52 52

o eoePI PI

2-wire copper cables

5 kV fix


Module type:USART-AD-1FO/STUSART-AE-2FO/ST

Communication converter


Fig. 8-4.30: Protection communication via a copper connection

52

52

52

52

SIPROTEC 5

1

3

4 ends differential protectionand binary input signals

Protection topology

PI 1

PI 1

PI 2

PI 1

PI 1

PI 2

SIPROTEC 5

SIPROTEC 5

2

SIPROTEC 5

4

Fig. 8-4.28: Protection communication of the differential protection and transfer of binary signals

52 52

PI PI



Multiplexer

2 Mbits/s 2 Mbits/s

C37.94 C37.94

Com-munication

network


Fig. 8-4.31: Protection communication via an IEEE C37.94 (2 Mbits/s) interface – direct fiber-optic connection to a multiplexer

52 52

PI PI




o

e

e

o9 μm/125 μmsingle-modeoptical fiber

up to 170 km

Repeater

Fig. 8-4.32: Protection communication via single-mode fiber and repeater

52 52

PI PI


Module type:Single module USART-AF-1LDFO/4 km/duplex LC

Double module USART-AW-2LDFO/4 km/2 x duplex LC

Single module USART-AG-1LDFO/60 km/duplex LCDouble module USART-AU-2LDFO/60 km/2 x duplex LC

Single module USART-AK-1LDFO/100 km/duplex LCDouble module USART-AV-2LDFO/100 km/2 x duplex LC

9 μm/125 μm single-mode optical fiber

FO direct connection

Fig. 8-4.33: Protection communication via direct fiber-optic connections



8


8.4.6 Requirements for Remote Data TransmissionIn principle, both RTUs and station automation are very flexible for adapting to any remote communication media supplied by the user.

Small substations are usually associated with small data volumes and poor accessibility of communication media. Therefore, dial-up modems are often used, also radio (if no lines available) or PLC communication. Sometimes even GPRS is an alternative, depending on the availability of a provider. Protocols also depend on the capabilities of the control center, but are mostly based on international standards like IEC 60870-5-101 (serial) and IEC 60870-5-104 (Ethernet), although DNP 3.0 is also found in some places (serial or over TCP/IP). Some small substations do not necessarily need to be online continuously. They can be configured to occasional calls, either locally or by external polling from the control center. Medium-size substations are generally connected via communication cables or optical fibers with serial end-end links. Serial lines with 1,200 Bd or higher are sufficient for IEC …-101 or DNP. Sometimes, multiple lines to different control centers are necessary, while redundant communication lines are reserved for important substations only. WAN technology is increasingly used in line with the trend towards more bandwidth.

Large substations, especially at transmission level, can have serial links as before, but with higher transmission rates. Anyway there is a trend towards wide area networks using Ethernet. For IEC …-104 or similar protocols a minimum of 64 kbit/s should be taken into account. If large data volumes are to be exchanged and additional services (e.g., Voice over IP, Video over IP) provided, the connection should have more bandwidth (64 kbit/s < Bandwidth ≤ 2,048 kbit/s).

Figs. 8-4.28 to 8-4.34 show possible communication variants for establishing protection communications.

52 52

PI PI


40 km with 9 μm/125 μm witha single-mode optical fiber

FO direct connection

Single module USART-AH-1LDFO/simplex LC

Single module USART-AJ-1LDFO/simplex LC

Fig. 8-4.34: Protection communication via a single-mode fiber


8


8.5 Communication Network Solutions for Distribution Grids (Backhaul/Access Communication)

8.5.1 Introduction

In the past, electricity was mainly produced by bulk generation at central locations, and distributed to consumers via the distri-bution systems. Energy peaks (e.g., at midday) were well known and balanced out by reserve capacity of central power plants. It was therefore usually not necessary to specially control the lower-level distribution networks, or even to integrate the consumers into the grid monitoring system.

Ever since renewable energy has been significantlyexpanded, electricity is being fed into both the medium-voltage and low-voltage systems, depending on changing external conditions (e.g., weather, time of day, etc.). These fluctuating energy resources can severely impair the stability of the distribu-tion grids.

Buildings account for 40 % of the world’s energy consumption and 20 % of total CO2 emissions. Therefore, smart buildings also play a central role in the Smart Grid as they provide a huge potential for energy efficiency. Actively influencing their con-sumption and generation, smart buildings support the system stability and allow generators to consider other options before adding new generation facilities.

One of the key challenges of a Smart Grid therefore is quickly balancing out the energy supply and energy consumption in the distribution system (fig. 8.5-1).

A prerequisite for implementing a solution for this demand is monitoring and managing as many components of a power supply system as possible all the way to the consumer. The basis for this is a reliable communication infrastructure. For medium voltage, at least the following system components must be integrated into a Smart Grid and managed:

The key ring-main units All large distributed producers (solar/wind farms, biogas/hydroelectric power plants, etc.) Large buildings, campuses, refrigerated warehouses, etc.

For low voltage, primarily households and small producers of renewable energy are involved.

With respect to their role in the power supply system, consumers can be divided into two groups:

“Standard consumers”, who have smart meters and optimize their electricity costs via ongoing price signals depending on supply and demand “Prosumers” (prosumer = producer + consumer), who can feed surplus energy into the power grid – such as solar power or energy generated by combined heat and power systems (CHP); many can also intermediately store energy using possibilities such as night storage heaters or e-cars.

While the communication requirements for standard consumers are concentrated on smart metering including price signals, time-critical control signals and power quality data must also be transmitted for prosumers. Therefore, in addition to smart meters, prosumers have energy gateways, which process and forward these control signals accordingly.

Low

vo

ltag

e(A

cces

s)

Communicationsinfrastructure

Fiber optics/SHD/EthernetBPLCWiMAXWireless meshGSM/UMTS/LTERouter, switch

Fiber opticsNPLC, BPLC, WiMAXWireless meshGSM/UMTS/LTEDSL, router, switch

Me

diu

m v

olt

age

(Bac

khau

l)

Applications

Control Center(EMS/DMS)

Virtual Power Plant

Micro Grid ControllerDistributionAutomation

Condition Monitoring

Demand ResponseManagement System

Marketplace

Asset Management

Meter DataManagement

Billing/Call CenterE-Car Operation Centeretc.

MV substation MV substation

400 V

MeterMeter Meter Meter Meter

400 V RMU 400 V RMU

6 kV–22 kV

400 V RMU

Public chargingfor e-carsCold store

Wind onshore

Building

Homes (smart meterwith other connection)


Smart homes withenergy gateway


RMU withmeter dataconcentrator

Fig. 8.5-1: Typical power distribution network integrating ring-main units, consumers, prosumers, distributed energy resources, etc.


8.5 Communications network solutions for distribution networks (Backhaul/Access communication)

8


The young history of Smart Grids has already shown that utilities do not implement it as a whole from the scratch. They usually start with smart metering projects with later extensions of Smart Grid applications.

Already with the first roll-out, the design of the communication infrastructure has to consider the growing requirements for these extensions. After a large deployment of metering infra-structure in the first step, it is not acceptable to replace the communication network a few years later because the require-ments for the next subsets of Smart Grid applications cannot be met anymore.

Communications infrastructures for all conditionsThe communication infrastructure in the medium-voltage and low-voltage distribution systems is usually heterogeneous, and the suitable technologies depend to a large extent on the local topology (large city, rural region, distances, etc.). It must there-fore be specifically tailored for each customer.

In general, the following communication technologies are available:

Fiber-optic or copper cables are the best option, if present Narrowband Power Line Carrier (NPLC) systems for transmitting meter data; they are frequently already integrated into the smart meters Broadband PLC systems offering IP connectivity with > 1 Mbps Setup of own private wireless networks (e.g., wireless mesh, private WiMAX), when spectrum is available at reasonable prices or local regulations allow for it Public wireless networks, depending on the installation for narrowband communication in the kbps range (e.g., GPRS), or in the future in the Mbps range (LTE, WiMAX providers). Attractive machine-to-machine (M2M) data tariffs and robust communication in case of power outages are key ingredients to make this communication channel a viable option.

Depending on the applications being installed inside the RMU, an Ethernet switch/router might be needed in order to concen-trate the flow of communications. These data concentrators can be implemented as customized solutions or integrated, for example, in the RTU (remote terminal unit). To meet these requirements, Siemens offers a full range of all above-men-tioned communication technologies including rugged switches and routers that comply with energy industry standards.

8.5.2 Communication Infrastructures for Backhaul and Access Networks

Optical fibersThe best choice for all communication needsOptical fibers is the best transmission medium for medium-voltage and low-voltage applications because it is robust and not susceptible to electromagnetic disturbances or capacity con-straints. That is why system operators who choose this tech-nology will be well prepared when their communication needs multiply in the future.

Fiber-optic cables are laid underground to connect individual substations. This work is associated with heavy civil works, and therefore with great expense. However, when new power cables are installed, the cost-benefit analysis paints a clear picture. Fiber-optic cables should generally be the first choice in this case.

Benefits in detail At the core of a variety of communication systems, from passive optical networks (PON) to Ethernet and SDH Durable, insusceptible to electromagnetic disturbancesPractically unlimited transmission capacity

Fiber optics Energy line Energy line with NPLC communication

MeterMeter Meter



MV substation6 kV–22 kV

400 V

Homes (smartmeter with wireless

connection)

Meter Meter

400 V RMU

Smart homeswith energy

gateway

400 V RMU

MV substation

400 V RMU


BuildingPublic charging

for e-carsCold store

Fig. 8-5.2: Fiber-optic infrastructure for distribution network



8


Broadband power line carrier

For low-voltage to medium-voltage applications, using the existing power line

BPLC is an attractive alternative for many applications in medium-voltage and low-voltage Smart Grid scenarios.

It uses the utility-owned infrastructure in the distribution system, and thus has no continuous OPEX for the communica-tion channel (operational expenditure). Therefore it is especially useful for connecting elements in the power supply system where there are no other communication media available.

Battery buffers allow the use of remote control with automation systems, even in cases of power loss.

Initially, the BPLC uses the medium-voltage lines between the distribution substation and the transformer substations as a communication infrastructure for process control in the medium-voltage domain.

In addition, the BPLC can use low-voltage lines as a communica-tion infrastructure for applications linking the transformer substations and consumers/households (for example, the integration of smart homes). The BPL modules feature both IP and RS 232 interfaces, and can therefore be used flexibly for diverse communication applications. Transmission range and bandwidth are heavily depending on the quality and the age of the power cable. As a rule of thumb, if the bandwidth in MV systems is in the range of up to 5 Mbps, a distance of up to 1,5 km is possible.

Energy lineEnergy line with NPLC communicationEnergy line with BPLC communication

MeterMeter Meter

MV substation

400 V

Meter Meter

400 V RMU 400 V RMU

6 kV–22 kV

MV substation

400 V RMU

Public chargingfor e-carsCold store

LVBPL

MVBPL

MVBPL

MVBPL

MVBPL

MVBPL

MVBPL

MVBPL

LVBPL

LVBPL

LVBPL

LVBPL

LVBPL

Homes (smart meter with

wireless connection)



gateway



Fig. 8-5.3: Broadband power line carrier for medium-voltage and low-voltage applications

WiMAX

For RMU backhaul and prosumers

The main application area for WiMAX is considered to be RMU backhaul. It also serves to connect scattered consumers or endpoints with more demanding communication requirements – in other words, prosumers.

WiMAX (worldwide interoperability for microwave access) is a standards-based telecommunication protocol (IEEE 802.16 series) that provides fixed and mobile broad-band connectivity. Originally designed as a wireless alternative to fixed network broadband Internet access, it has evolved over the past ten years into an advanced point-to-multipoint system that also supports mobile applications like workforce management. The technology is field-proven, globally deployed, and continues to evolve. WiMAX networks can be scaled from small to large, which allows for privately owned networks even on regional and local levels.

Detailed requirements as well as specific regional conditions and spectrum availability must be carefully assessed in order to select the best-suited technology and product combination from a wide variety of options.

Basic technical data Average data rate: ~10 Mbps; can be extended with IEEE 802.16m to over 50 Mbps Average coverage: up to 10 km in non-line-of-sight and up to 30 km in line-of-sight conditions Radio spectrum in licensed or license-exempt frequency bands

MeterMeter Meter

Service car

400 V

Meter Meter

400 V RMU 400 V RMU 400 V RMU



CommunicationEnergy lineEnergy line withNPLC communication



gateway

MVsubstation

MVsubstation



6 kV–22 kV

Fig. 8-5.4: WiMAX network



8


Wireless mesh

From consumer access to RMU backhaul

The applications for wireless mesh networks stretch from con-sumer access to RMU backhaul. Wireless mesh networks are composed of cooperating radio nodes organized in a mesh topology. The underlying technology for communication from one hop to another can be standardized (for example, the IEEE 802.11 series [Wi-Fi] or IEEEE 802.15.4 [low-rate wireless per-sonal area network, LoWPAN]) or proprietary (for example, U.S. 900-MHz technologies). The mesh protocols and corresponding routing mechanisms are, on the other hand, more recent devel-opments and therefore are still predominantly proprietary. Thanks to their mesh properties along with self-setup and self-healing mechanisms, mesh networks inherently offer ease of operation and redundancy for fixed applications ‒ but perfor-mance is limited in terms of either coverage or bandwidth.

Detailed requirements as well as specific regional conditions must be carefully assessed in order to select the best-suited technology.

Basic technical data Average data rate per hop: from ~100 kbps (U.S. 900-MHz) up to ~10 Mbps (Wi-Fi); net data rates per hop decrease with increasing number of hops Average range hop-to-hop: ~1 km nLoS/~5 km LoS (U.S. 900-MHz); ~100 m nLoS/~1 km LoS (Wi-Fi) coverage extension by means of mesh Radio spectrum primarily in license-exempt frequency bands

MeterMeter Meter

MV substation

400 V

Meter Meter

400 V RMU 400 V RMU

MV substation

400 V RMU






6 kV–22 kV


gateway


Fig. 8-5.5: Wireless mesh network

Public cellular networks

For the extension of private communication networks

The main application areas for public mobile radio networks in the Smart Grid context are meter reading and energy grid moni-toring functions.

In contrast to constructing new, proprietary networks for Smart Grid communication, there is also the option of using existing cellular radio networks owned by communication service pro-viders. These networks are standards-based, deployed world-wide, and continuously upgraded and expanded. Activities like acquiring spectrum licenses, building, operating and main-taining the network as well as assuring sufficient coverage and bandwidth on a nationwide scale are naturally managed by the communication service providers. Data rates normally available range from 50 kbps (GPRS), over 10 Mbps (HSPA), to over 50 Mbps (upcoming LTE). Attractive data tariffs and the availability of the network are key to use public cellular networks for Smart Grid applications.

MeterMeter Meter

Servicecar

MV substation

400 V



Meter Meter

400 V RMU 400 V RMU 400 V RMU




6 kV–22 kV

Smart homeswith energygateway

MVsubstation


Fig. 8-5.6: Public cellular network


8.6 IT Security

8


8.6 IT SecurityIf you imagine plant availability as an equation with a large number of variables, dependable IT security is one of the essen-tial variables. It comprises, in particular, protection against unauthorized access, physical attacks and operator errors, as well as internal or external threats. What counts more than anything ultimately, though, is the result, namely a functioning energy automation system. That is precisely the philosophy of Integrated Energy Automation (IT Security). Integral solutions combine the individual variables to create a transparent equa-tion that is maximized with regard to system uptime. With Integrated Energy Automation, Siemens offers an IT security concept that not only ensures the confidentiality and integrity of data, but most importantly its availability. Users profit especially from the simplified workflow, reliable operation and significantly reduced total costs of ownership.

8.6.1 Integral Approach

The graphical display of the security network or network blue-print, as it is called, forms the infrastructure and architecture of a system. It is the basis for a clear segmentation with which the risk for every link in the automation chain can be analyzed precisely – while still keeping an eye on the impact on the system as a whole.

The network is therefore divided up into manageable zones in order to equip them with precisely the IT security that is necessary and worthwhile in order to protect the data in this zone, as well as ensuring smooth operation of the system at the same time (fig. 8.6-1).

The zones are protected at network level by a SCADA firewall that controls data traffic between the zones and blocks dangerous packets. Suspicious network activities within critical zones them-selves, for example, the control center network or field level can be detected and signaled by an intrusion detection system.

Transfernetworks

Admin LAN

DMZ (demilitarized zone) SCADA honeypot

Spectrum Power client pool Spectrum Power server pool

SCADA firewall

SCADA firewall

SCADA firewall

SIPROTEC network

SICAM PAS network

Con

trol

cen

ter

Subs

tati

onFi

eld

devi

ces

DMZ (demilitarized zone) DMZ (demilitarized zone) SICAM 1703 network

Secure remote access Secure remote access

Secure remote access

Trusted network

Semi-trusted network

Untrusted network

Office network

Other control center

Network blueprint incorporates:Sophisticated logging and auditing conceptRegular cyber security assessmentHardened network infrastructure(switches, router)

SIPROTEC network

Hardened host

VPN tunnel

Host-based intrusionprevention system

Network-based intrusiondetection system

Web server

Anti virus

Fig. 8.6-1: Zoned IT security concept


8.6 IT Security

8


Computers exposed to special risks, for example, in the demilita-rized zone (DMZ), can also be protected with a host-based intrusion prevention system. All computer systems are equipped with virus scanners in order to withstand the permanent threat due to malware. The remote administration and connection of other networks is effected by VPN tunnels that guarantee access protection at the highest level.

The load-carrying network infrastructure itself (routers, switches) also undergoes system hardening in order to match up to the consistently high security requirements for the system as a whole.

8.6.2 Secure throughout from Interface to InterfaceWith the advent of the Internet and increasing networking within the systems, every interface represents a potential risk. These risks must be easy to estimate in the system. With Inte-grated Energy Automation, Siemens therefore applies the philos-ophy of IT security offering simple protection. For this reason, Siemens attaches greatest importance to homogenization by means of standardized and reproducible processes for authenti-cation, authorization, intrusion detection and prevention, mal-ware protection, effective patch management for third-party components, standard logging and continuous security tests.

8.6.3 Continuous Hardening of ApplicationsReliable products are an essential basis for a secure network. Siemens therefore continuously hardens its products to protect them against attacks and weak points. Individual risk analyses and regular tests – also specially for third-party components – with a defined combination of IT security test programs for detecting weak points (Test Suite) are used for this.

8.6.4 In-House CERT as Know-how PartnerSiemens has its own in-house Computer Emergency Response Team (CERT). An organization such as this that discusses sub-jects critical to IT security and issues current warnings is nor-mally only maintained by universities or governments in order to provide users with cross-industry information.

The Siemens in-house CERT was established in 1997 and since then has issued warnings about security loopholes, while offering approaches for solutions which are processed especially for the company’s areas of competence. As know-how partner, the work of the Siemens CERT also involves drawing up rules for the secure development and programming of in-house products and the continuous further training of in-house programmers.

CERT checks the products for weak points by means of selective hacker attacks. The team also collects and distributes reports on weak points and upgrade reports for third-party components and links them to recommendations, concrete proposals and implementation specifications.

8.6.5 Sensible Use of Standards

The object of standards is to guarantee quality, to increase IT security in the long term, and to protect investment. There are now hundreds of IT security standards in existence, but only some of them are really necessary and worthwhile for a system.

On the basis of its many years experience in the market, Siemens chooses those standards and guidelines that protect a network reliably and effectively. This also includes advising customers on which IT security standards need to be observed at international and also at regional level.

The object of Integrated Energy Automation (IT Security) is permanent IT security for the system in the long term. Therefore reliable and secure products and infrastructures are not enough. With Integrated Energy Automation, Siemens also implements appropriate security processes that ensure that IT security is actively implemented throughout, both internally and at the plant operator‘s, and is guaranteed over the entire life cycle of the plant.

8.6.6 IT Security Grows in the Development ProcessThe integral approach with Integrated Energy Automation not only involves keeping an eye on the entire system, but also means that security of products is already integrated in the entire development process, and not just in the test phase.

IT security guidelines for development, processing, service and other functions ensure that IT security is actively implemented throughout all processes. Examples of this are security briefings for product management before a product is developed or programmed in the first place. Programmers operate according to defined guidelines for secure coding, which are specified by the Siemens CERT.

For an effective patch management, Siemens tests updates of third-party security products, for example, firewalls, already in the development process of the products. Continuous penetra-tion tests of all relevant products are stipulated in a test plan. This also includes the definition and establishment of a security test environment and matching test cases.

In this way, Siemens subjects its products to an objective and critical certification process with which IT security is guaranteed and made transparent on the basis of suitably selected stan-dards.


8.6 IT Security

8


8.6.7 Integrating IT Security in Everyday OperationsA system is only as secure as the user operating it. A high stan-dard of security can therefore only be achieved by close coopera-tion between manufacturers and operators. The patch manage-ment process is also important after acceptance testing of a system. For this purpose, the Siemens CERT issues automated reports on newly discovered weak points that could affect third-party components in the products. This enables the Sie-mens customers to be informed promptly, and allows time to define any service activities arising from this.

A very wide choice of helpful tools is available to enable users to make IT security a regular part of everyday operation of a system. Standardized security processes, for example, for updates and system backups, are implemented directly. At the same time, efficient tools are provided for administering access in a system network. This includes effective management of rights as well as reliable logging tools. Automatically created protocols or log files are not only stipulated by law, but also help determine at a later time how damage to a system occurred.

With Integrated Energy Automation, Siemens offers an intelli-gent interaction of integral solutions for simple and reliable energy automation.


8.7 Services

8


8.7 ServicesBusiness with communication solutions for power supply compa-nies does not only mean to provide state-of-the-art products, but to offer a complete range of build and professional services. With more than 75 years of experience and know-how, Siemens offers a wide range of products for communication solutions, and a comprehensive portfolio of services tailored to the demand of our customers (fig. 8.7-1).

ConsultFinding the right communication solution in a pre-sales or after sales phase for the costumers requires planning and analysis. Siemens consultants offer every support in planning and realiza-tion of the best technical and economic solution for communica-tion networks, system configuration, and integration of the new equipment into the existing network.

DesignDesigning a telecommunication network means much more than just supplying hardware and software. The Siemens experience makes it possible to create a and prove a communication solu-tion designed exactly for the operator‘s purposes.

BuildThe fast implementation of a project depends crucially on effective management. It ensures that the build-up of a network will be completed quick and effective.

Maintain/CareThe Siemens hotline, its technical level supports, and repair and replacement concept for defective modules as part of the after-sales service, gives full support and provides the required hard-ware and software for updating or upgrading communication systems already in operation in existing networks.

EducateWell-trained staff that knows how to bring the communication network to its optimal use is crucial in obtaining the full benefits from the investments. Siemens therefore focuses not only on providing custom-made communication network solutions, but also on sharing its knowledge and experience with its others. Siemens offers a comprehensive training program for the com-plete area of communication solutions for power supply compa-nies. Training is always tailored to the area of responsibility, as well as to the corresponding technology and practice.

Plant operators

Commissioning

Installationsupervision

Site survey

BuildConsult Design Care Educate

Technical support

Practicaltraining

Theoreticaltraining

HotlineDocumentation

Engineering

Proof of concept

Technicalconsulting

Regional offices partners

Build and professional managed services

Projectmanagement

System integration Upgrades

R & R

Fig. 8.7-1: Service portfolio

Documents

Communication Network Solutions for Smart Grids · PDF fileWIFI Mesh Network management ... Communication network solutions for Smart Grids. ... 8.2 Communication Network Solutions